CN112527598A

CN112527598A - Method, apparatus, device, storage medium and program product for monitoring data

Info

Publication number: CN112527598A
Application number: CN202011462216.1A
Authority: CN
Inventors: 高佳; 代闯仁
Original assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Current assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Priority date: 2020-12-10
Filing date: 2020-12-10
Publication date: 2021-03-19
Anticipated expiration: 2040-12-10
Also published as: CN112527598B

Abstract

The application discloses a method, a device, equipment, a storage medium and a program product for monitoring data, which are applied to the technical field of intelligent recommendation and big data. The specific implementation scheme is as follows: acquiring index values of a plurality of preset indexes aiming at target data at a plurality of moments respectively to obtain a plurality of index values of the plurality of preset indexes respectively; aiming at each index in a plurality of preset indexes, determining an alarm threshold value of each index according to distribution information of a plurality of index values of each index; determining the significance of each index along with the change of time according to a plurality of index values of each index; and determining a monitoring index in the plurality of preset indexes according to the significance so as to monitor the target data according to the monitoring index and the alarm threshold value of the monitoring index.

Description

Method, apparatus, device, storage medium and program product for monitoring data

Technical Field

The present application relates to the field of data processing, in particular to the field of intelligent recommendation and big data technologies, and more particularly to a method, an apparatus, a device, a storage medium, and a program product for monitoring data.

Background

With the development of computer technology, various products for providing online services to users have appeared. In order to avoid problems when a product runs on a line, the product is usually tested off-line, and data generated in the process of running on the product line is monitored.

In the related art, a business person sets a policy for monitoring data based on experience. However, with the increase of the online services of the product and the acceleration of the updating frequency of the online services, the monitoring strategy for monitoring the data generated in the operation process of the product needs to be frequently added and updated, which puts higher requirements on the capability of the service personnel and puts greater challenges on the accuracy and effectiveness of the monitoring result.

Disclosure of Invention

A method, apparatus, device, storage medium, and program product are provided for recommending a monitoring policy based on historical data to thereby reduce business stress and improve monitoring accuracy and effectiveness.

According to a first aspect, there is provided a method of monitoring data, comprising: acquiring index values of a plurality of preset indexes aiming at target data at a plurality of moments respectively to obtain a plurality of index values of the plurality of preset indexes respectively; aiming at each index in a plurality of preset indexes, determining an alarm threshold value of each index according to distribution information of a plurality of index values of each index; determining the significance of each index along with the change of time according to a plurality of index values of each index; and determining a monitoring index in the plurality of preset indexes according to the significance so as to monitor the target data according to the monitoring index and the alarm threshold value of the monitoring index.

According to a second aspect, there is provided an apparatus for monitoring data, comprising: the index value acquisition module is used for acquiring the index values of a plurality of preset indexes aiming at the target data at a plurality of moments respectively to obtain a plurality of index values of the plurality of preset indexes; the threshold value determining module is used for determining an alarm threshold value of each index according to the distribution information of a plurality of index values of each index aiming at each index in a plurality of preset indexes; the significance determination module is used for determining the significance of each index along with the change of time according to a plurality of index values of each index; and the monitoring index determining module is used for determining a monitoring index in the plurality of preset indexes according to the significance so as to monitor the target data according to the monitoring index and the alarm threshold value of the monitoring index.

According to a third aspect, there is provided an electronic device comprising: at least one processor; and a memory communicatively coupled to the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method for monitoring data provided herein.

According to a fourth aspect, there is provided a non-transitory computer readable storage medium having stored thereon computer instructions for causing a computer to perform the method of monitoring data provided herein.

According to a fifth aspect, a computer program product is provided, comprising a computer program which, when executed by a processor, carries out the method of monitoring data as provided herein.

It should be understood that the statements in this section do not necessarily identify key or critical features of the embodiments of the present disclosure, nor do they limit the scope of the present disclosure. Other features of the present disclosure will become apparent from the following description.

Drawings

The drawings are included to provide a better understanding of the present solution and are not intended to limit the present application. Wherein:

FIG. 1 is a schematic diagram of an application scenario of a method, an apparatus, a device, a storage medium and a program product for monitoring data according to an embodiment of the application;

FIG. 2 is a schematic flow diagram of a method of monitoring data according to an embodiment of the present application;

FIG. 3A is a schematic diagram illustrating the determination of an alarm threshold according to an embodiment of the present application;

FIG. 3B is a schematic diagram illustrating determination of an alarm threshold according to another embodiment of the present application;

FIG. 4 is a schematic diagram of determining an alarm threshold according to another embodiment of the present application;

FIG. 5 is a schematic diagram of determining an alarm threshold according to another embodiment of the present application;

FIG. 6 is a schematic diagram of determining an alarm threshold according to another embodiment of the present application;

FIG. 7 is a block diagram of an apparatus for monitoring data according to an embodiment of the present application; and

fig. 8 is a block diagram of an electronic device for implementing a method of monitoring data according to an embodiment of the present application.

Detailed Description

The following description of the exemplary embodiments of the present application, taken in conjunction with the accompanying drawings, includes various details of the embodiments of the application for the understanding of the same, which are to be considered exemplary only. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present application. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

The application provides a method for monitoring data. The method comprises the steps of firstly obtaining index values of a plurality of preset indexes aiming at target data at a plurality of moments respectively, and obtaining a plurality of index values of the preset indexes respectively. Then, for each index in a plurality of preset indexes, determining an alarm threshold value of each index according to distribution information of a plurality of index values of each index, and determining the significance of the change of each index with time according to a plurality of index values of each index. And finally, determining a monitoring index in the plurality of preset indexes according to the significance so as to monitor the target data according to the monitoring index and the alarm threshold value of the monitoring index.

An application scenario of the method and apparatus provided by the present application will be described below with reference to fig. 1.

Fig. 1 is a diagram of an application scenario of a method, an apparatus, a device, a storage medium, and a program product for monitoring data according to an embodiment of the present application.

As shown in fig. 1, the application scenario 100 of this embodiment may include, for example, a terminal device 110.

The terminal device 110 may be, for example, various electronic devices capable of providing an interactive interface and having a processing function, including but not limited to, a smart phone, a tablet computer, a laptop portable computer, a desktop computer, and the like.

Illustratively, various client applications may be installed in the terminal device 110, such as a map navigation-type application, a search-type application, an instant messaging tool, a web browser application, a news-type application, a video playing-type application, and so on (for example only). A large amount of data 130, such as download traffic, upload traffic, access volume, etc., is generated during the operation of each application.

Illustratively, the terminal device 110 may also be provided with a control system for controlling each device in various article production systems and recording the operation state of each device, for example. A large amount of data 130 is also generated during the operation of the control system, such as the operating parameters of the various devices in the production system. Alternatively, the terminal device 110 may access the website through a web browser application, and during the access process, the operation of the website needs to be monitored.

According to the embodiment of the present application, in order to ensure the normal operation of the application or the production system, it is generally required to monitor the data 130 generated during the operation of the application or the production system, and determine whether the application or the production system is operating normally according to the monitoring result. In the case where a control system is provided in the terminal device 110, the operating parameters of each device in the production system may be monitored by the control system.

In an embodiment, as shown in fig. 1, the application scenario 100 may further include a server 120, and the server 120 and the terminal device 110 are connected through a network. The server 120 may be used, for example, to monitor data 130 generated during the running of applications by the terminal device 110 or the control of a production system. The server 120 may be, for example, an application server, a server of a distributed system, or a server incorporating a blockchain. Alternatively, the server may also be a virtual server, a cloud server, or the like.

In one embodiment, the data 130 generated by the terminal device 110 is facilitated to be subsequently invoked. As shown in fig. 1, the application scenario 100 may further include a database 140, and the terminal device 110 may access the database 140 through a network to store the generated data 130 in the database 140.

In an embodiment, the server 120 may also access the database 140 through a network, for example, to obtain history data generated by the terminal device 110 in the near future, and determine a monitoring policy 150 for monitoring subsequently generated data according to the history data.

In an embodiment, the server 120 may also monitor an application or a control system in the terminal device 110 according to the monitoring policy 150 to implement monitoring of the data 130. Therefore, whether the production system controlled by the application program or the control system runs normally or not can be known in real time.

It should be noted that the method for monitoring data provided by the embodiment of the present application may be generally performed by the server 120. Accordingly, the device for monitoring data provided by the embodiment of the present application may be generally disposed in the server 120.

It should be understood that the types of terminal devices, servers, and databases in fig. 1 are merely illustrative. There may be any type of terminal device, server, and database, as the implementation requires.

The method for monitoring data provided by the embodiment of the present application is described in detail with reference to fig. 2 to 6 in the application scenario described in fig. 1.

Fig. 2 is a schematic flow chart diagram of a method of monitoring data according to an embodiment of the present application.

As shown in fig. 2, the method 200 of monitoring data of this embodiment includes operation S210, operation S230, operation S250, and operation S270. It is understood that operations S230 and S250 may be performed according to any order. For example, the operations S230 and S250 may be performed simultaneously, and the operations S230 may be performed before the operations S250, or after the operations S250.

In operation S210, index values of a plurality of preset indexes for target data at a plurality of times are obtained, and a plurality of index values of the plurality of preset indexes are obtained.

According to the embodiment of the application, the target data may be any one of a plurality of data generated during the operation of an application program in the terminal device or the operation of a production system controlled by the control system, for example. For example, the target data may be any one of: upload traffic, download traffic, run time, power consumption, throughput, concurrency, etc.

For example, after the target data is generated, index values of a plurality of indexes of the target data may be obtained by comparing the generated target data with the target data generated in the history, and the index values may be stored in the database. The operation S210 may directly read index values of a plurality of indexes from the database. The plurality of time instants may be, for example, time instants included in a preset time period. The preset time period may be a day, a week, a month, a year, or the like, and the preset time period may be a history time period closest to the current time.

Illustratively, the preset index may include any one of: the value of the data, the homocyclic ratio, the homocyclic difference, the cyclic ratio difference, the fluctuation slope, the fluctuation trend, the homocyclic difference, and the like.

According to the embodiment of the application, the index values of the preset indexes can be obtained by analyzing the numerical values of the target data at multiple moments. For example, values of the target data at a plurality of times may be obtained, and then index values of a plurality of preset indexes of the target data at a plurality of times may be determined according to the values of the target data at the plurality of times. The values at the plurality of times may be obtained from a database, for example. For example, the embodiment may simultaneously acquire the values for comparison with the values at the plurality of times from the database, so as to determine the index values of the indexes such as the homonymy, homonymy difference, homonymy ratio, homonymy difference, fluctuation slope, fluctuation tendency, and the like for the values at the plurality of times.

Illustratively, the values of the target data at a plurality of times may be entered, for example, by business personnel. Alternatively, the service personnel can provide an access address of the database, and the server reads the value of the target data from the database according to the access address. Alternatively, the server may obtain the value of the target data by calling an interface provided by an application program or the like that needs to be monitored. The target data may be, for example, of a key-value pair type, where a key represents a data type and a value is a numerical value of the data. It is to be understood that the above-mentioned manner of acquiring the target data is merely an example to facilitate understanding of the present application, and according to an actual scenario, any manner may be adopted to acquire the values of the target data at multiple times.

According to embodiments of the present application, the single period may be, for example, one year, one quarter, one month, one week, or the like, for the comparability index. For the ring ratio index, the single period is an arbitrary length that is shorter in length than the single period for the same ratio index. For example, for the same-ratio index, the single cycle is one year, and for the ring-ratio index, the single cycle is one month.

In operation S230, for each index of a plurality of preset indexes, an alarm threshold value of each index is determined according to distribution information of a plurality of index values of each index.

According to an embodiment of the present application, the operation S230 may determine the alarm threshold value according to a size distribution of a plurality of index values of each index, for example. The alarm threshold may only include an upper alarm threshold or a lower alarm threshold, or may include not only the upper alarm threshold but also the lower alarm threshold. The type of the alarm threshold may be defined according to the actual requirement for monitoring the target data, which is not limited in the present application.

Illustratively, for the throughput index, if the throughput of a preset proportion of the time instants in the plurality of time instants is 100/s to 1000/s, it may be determined that the alarm threshold includes an upper threshold of 1000/s and a lower threshold of 100/s. The preset proportion can be set according to actual requirements, and the method is not limited in the application.

In operation S250, a degree of significance of each index varying with time is determined according to a plurality of index values of each index.

According to an embodiment of the application, the significance of each index over time may be related to any of the following values of the plurality of index values at a plurality of time instants, for example: variance, difference between maximum and minimum, covariance, second order difference, coefficient of variation, etc.

For example, after a plurality of index values of each index are acquired, any one of the above values of the index may be calculated, and the value may be used as the degree of significance. Or, after obtaining any one value for each index, normalizing any one value of the plurality of indexes, and taking the normalized value as the degree of significance of the change of the index with time.

In operation S270, a monitoring index of the plurality of preset indexes is determined according to the degree of significance, so as to monitor the target data according to the monitoring index and an alarm threshold of the monitoring index.

According to the embodiment of the application, after the significance is obtained for each index, one index with the largest significance in the plurality of indexes can be used as a monitoring index. Alternatively, a preset number of indexes with a higher degree of significance among the plurality of indexes may be used as the monitoring index.

After the monitoring index is obtained, the monitoring index and the alarm threshold value of the monitoring index can be displayed as a recommended monitoring strategy, so that service personnel can set an alarm according to the recommended monitoring strategy. Or after the monitoring index is obtained, the data generated in the terminal equipment can be directly monitored by the recommended monitoring strategy, and under the condition that the generated data is determined to be larger than the alarm threshold value, the alarm information is sent out, and the business personnel is reminded that the application program in the terminal equipment, the access website or the production system controlled by the control system abnormally operate, so that the abnormality is eliminated in time, the application program, the website and the production system can normally operate, and the user experience is improved.

As can be seen from the above description, the method for monitoring data according to the embodiment of the present application may determine a monitoring policy according to historical data. Therefore, when new type data is generated due to service updating, a monitoring strategy for the new type data can be set according to the data generated in a preset time period, and service personnel do not need to add the monitoring strategy according to manual experience. Or, in a case where the value of the data changes significantly due to the service update (for example, in a case where the throughput is significantly improved), a suitable alarm threshold may be determined again according to the newly generated throughput, without a service person alarming the alarm threshold according to experience. Therefore, the accuracy of data monitoring can be improved, and the cost of data monitoring and maintenance can be reduced.

According to the embodiment of the application, when the alarm threshold value of each index is determined, for example, a plurality of moments may be divided into a plurality of periods, and then one alarm threshold value may be determined for each of the plurality of periods. Therefore, the determined alarm threshold value can better meet the requirements of different time periods, and the accuracy of data monitoring is improved conveniently.

Fig. 3A is a schematic diagram of determining an alarm threshold according to an embodiment of the present application.

According to the embodiment of the application, the multiple moments can be divided into multiple time periods according to the attributes of the natural days to which the multiple moments belong, so that the moments with the same attributes of the natural days are divided into the same time period, and the moments with different attributes of the natural days are divided into different time periods. For example, as shown in embodiment 300 of FIG. 3A, a plurality of times 310 may be divided into weekday periods 321 and non-weekday periods 322. The non-workday period 322 includes holidays, and the like, and correspondingly, the workday period 321 also includes a rest workday.

After dividing the plurality of time points into a plurality of time periods, the index value sequence of each index for each time period may be determined according to the index value of each index at each time point in each time period. For example, the index values of each index at respective times in each period may be arranged in time to constitute an index value sequence. For example, a first index value sequence 331 may be obtained for a working day period 321, and a second index value sequence 332 may be obtained for a non-working day period 322.

After the index value sequence for each period is obtained, the alarm threshold value of each index for each period may be determined according to the distribution information of the index values in the index value sequence for each period. For example, the first alarm threshold 341 for the working day period 321 is determined to be obtained according to the distribution of the plurality of index values in the first index value sequence 331. A second alarm threshold 342 for the non-weekday period 322 is determined based on the distribution of the plurality of index values in the second sequence of index values 332.

According to the embodiment of the application, the time is divided according to the attributes of the natural day, so that a large difference of data generated by the terminal equipment in the natural days with different attributes due to the influence of factors such as social effect can be considered, and reasonable setting of the index alarm threshold can be realized. The condition that false alarm is easy to occur due to high sensitivity of the determined alarm threshold value during data monitoring because of data with large difference generated by different service demands in different periods is avoided, and therefore the accuracy of data monitoring can be improved.

FIG. 3B is a schematic diagram illustrating determination of an alarm threshold according to another embodiment of the present application.

According to the embodiment of the present application, as shown in the embodiment 300 'shown in fig. 3B, the preset time period 310' may be divided into a plurality of time periods with equal length according to the period distribution of the index values, for example, the preset time period may be divided into the first time period 321 'and the second time period 322'. Each time period may include multiple time intervals, and the different time periods include the same time intervals, e.g., first time period 321 'and second time period 322' each include first time interval 331 'and second time interval 332'. Index values of the index at respective times in the same time interval in the plurality of time periods are close to each other. The embodiment can divide the time belonging to the same time interval in a plurality of time periods into one time period, so as to obtain a plurality of time periods. For example, a time belonging to the first time interval 331 'included in the first time period 321' and a time belonging to the first time interval 331 'included in the second time period 322' among the plurality of times may be divided into the first period 341 ', and a time belonging to the second time interval 332' included in the first time period 321 'and a time belonging to the second time interval 332' included in the second time period 322 'among the plurality of times may be divided into the second period 342'.

After dividing the plurality of time points into a plurality of time periods, the index value sequence of each index for each time period may be determined according to the index value of each index at each time point in each time period. For example, the index values of each index at respective times in each period may be arranged in time to constitute an index value sequence. After the index value sequence for each period is obtained, the alarm threshold value of each index for each period may be determined according to the distribution information of the index values in the index value sequence for each period. For example, the first alarm threshold value for the first period 341 'is determined according to the distribution of the plurality of index values in the index value sequence for the first period 341'. According to the distribution of the index values in the index value sequence for the second period 342 ', a second alarm threshold value for the second period 342' is determined.

Illustratively, the time period may be, for example, one week, which includes, for example, seven time intervals, one time interval for each day. Alternatively, the time period may be, for example, a day, which may include, for example, 12 time intervals, one time interval for each time of day. Alternatively, the day may include 24 time intervals, one time interval for each hour.

It is to be understood that the number of time periods included in the preset time period and the number of time intervals included in each time period are only examples to facilitate understanding of the present application, and the present application is not limited thereto.

According to the embodiment of the application, the time period is divided into the plurality of time intervals, and the time of the same time interval belonging to different periods is divided into the same time period, so that the large difference of data generated by the terminal equipment in different time intervals due to different requirements can be considered, and the accurate setting of the index alarm threshold value can be realized. The condition that false alarm is easy to occur due to high sensitivity of the determined alarm threshold value during data monitoring because of data with large difference generated by different service demands in different periods is avoided, and therefore the accuracy of data monitoring can be improved.

FIG. 4 is a schematic diagram illustrating the determination of an alarm threshold according to another embodiment of the present application.

According to the embodiment of the application, each time interval can be further divided into a plurality of sub-time intervals after the time belonging to the same nature day and having the same attribute is divided into the same time interval. Thereby obtaining a monitoring threshold value for each sub-period, so as to further improve the monitoring accuracy. Accordingly, in determining the index value sequence for each period, each period may be first divided into a plurality of sub-periods according to a preset rule. And then, for each sub-period in the plurality of sub-periods, determining an index value sequence for each sub-period according to the index value of each index at each moment in each sub-period. In determining the alarm threshold value of each index for each period, for each sub-period, the alarm threshold value of each index for each sub-period is determined according to the index value sequence of the index for each sub-period.

Illustratively, the preset rule may be an aliquoting rule. As with embodiment 400 shown in fig. 4, after dividing the plurality of times of day 410 into weekday periods 421 and non-weekday periods 422, each day in weekday periods 421 may be divided into 24 sub-periods, each of which is one hour. For example, when the working day includes m days, a sub-period set composed of m sub-periods with a time interval of [0:00, 1:00) in m days is used as a first sub-period 431 obtained by final division, and a sub-period set composed of m sub-periods with a time interval of [1:00, 2:00) in m days is used as a first sub-period 432 obtained by final division. By analogy, 24 first sub-periods may be obtained. In a similar manner, the non-workday period 422 may likewise be divided into 24 sub-periods, resulting in a second sub-period 441, a second sub-period 442, and so on.

After obtaining the plurality of first sub-periods of the working day period and the plurality of second sub-periods of the non-working day period, as shown in fig. 4, for each of the plurality of first sub-periods and the plurality of second sub-periods, the index values at the respective times in each sub-period are arranged in time to obtain the index value sequence for each sub-period. Thereby obtaining a first series of indicator values 451, a first series of indicator values 452, 462, a second series of indicator values 461, a second series of indicator values 462, a total of 48 series of indicator values. An alarm threshold value can be obtained according to the distribution information of the index value of each index value sequence in the 48 index value sequences. Resulting in an alarm threshold for each sub-period, including alarm threshold 471, alarm threshold 472,. alarm threshold 481, alarm threshold 482, etc.

According to the embodiment of the present application, when each time interval is divided into a plurality of sub-time intervals according to a preset rule, the division rule may be set according to the actual requirement of the service, which is not limited in the present application. For example, if it is determined that the target data has high sensitivity to time according to the traffic type, the sub-period may be divided into units of half an hour, 15min, 10min, 1min, and the like. If the target data has low sensitivity to time, the sub-period can be divided into units of 1 hour, one hour, 6 hours, 1 day, and the like.

According to the embodiment of the application, when each time interval is divided into a plurality of sub-time intervals according to the preset rule, each time interval can be divided into a plurality of sub-time intervals according to the difference degree between the index values of two adjacent moments of each index in each time interval, so that two moments corresponding to two index values with the difference degree larger than the first preset threshold value are divided into different sub-time intervals. In this case, the lengths of the divided sub-periods may be equal to or different from each other. Wherein, the difference degree between the index values of two adjacent time points can be represented by standard deviation, variance and the like. The first preset threshold may be set according to actual requirements, for example, if the fluctuation of the target data over time is large, the threshold may be set to be higher, and if the fluctuation of the target data over time is small, the threshold may be set to be lower. The embodiment can make the division of the sub-period more consistent with the data characteristics by dividing the sub-period according to the above manner, so that the index value in each sub-period is relatively smooth, and thus the accuracy of the determined alarm threshold value can be improved.

It is to be understood that the above predetermined rules are merely examples to facilitate understanding of the present application, and different predetermined rules may be set for different types of target data. Furthermore, different first preset thresholds may be set for different indexes of the plurality of indexes, for example, a larger first preset threshold may be set for the value of the data, and the first preset threshold set for the same-ring difference may be larger than the first preset threshold set for the ring ratio difference. The present application does not limit the selection of the predetermined rule and the first preset threshold.

According to the embodiment of the application, after the plurality of sub-periods are obtained through division in the above manner, the index value at each time in each sub-period can be analyzed for each sub-period, the abnormal index value is selected from the analyzed index values and removed, and finally, the sequence formed by the index values remaining after the abnormal index value is removed is used as the index value sequence for each sub-period. By the method, the value of the index value in each index value sequence can be further smoothed, the influence of abnormal data on the determined alarm threshold value is avoided, and the accuracy of the alarm threshold value is further improved.

For example, when the index value at each time in each sub-period is analyzed, for example, an average value of a plurality of index values of each index at a plurality of times belonging to each sub-period may be determined. Then, the degree of deviation of each index value of the plurality of index values from the average value is determined. And finally, taking the preset number of index values with larger deviation degree as abnormal index values. Or, the index value of which the deviation degree is greater than the preset value is taken as the abnormal index value. The degree of deviation can be represented by, for example, an absolute difference between the index value and the average value, a ratio between the absolute difference and the average value, or the like.

According to the embodiment of the application, after the difference degree between the index values at two adjacent time points is obtained, the monitoring index can be determined by taking the difference degree as a reference. For example, if the degree of difference between the same-ring ratios at any two adjacent times in each time interval is small, the same-ring ratio may be excluded when the monitoring index is selected from a plurality of indexes.

FIG. 5 is a schematic diagram illustrating the determination of an alarm threshold according to another embodiment of the present application.

According to the embodiment of the application, in the case that each period includes a plurality of sub-periods in the same time interval in a plurality of time cycles, the data in the plurality of sub-periods belonging to the same period may be compared with each other, the abnormal time may be determined according to the comparison result, and finally the index value of the abnormal time may be eliminated as the abnormal value. And determining an alarm threshold value after eliminating the abnormal index value. By the method, the data at the abnormal moment can be removed, so that the accuracy of the determined alarm threshold value is further improved.

For example, in order to eliminate the index value at the abnormal time, when determining the index value sequence of each index for any one of the plurality of periods, the embodiment may first determine, for each sub-period of the plurality of sub-periods included in the any one period, the index value sequence for each sub-period according to the index value of each index at each time in each sub-period, so as to obtain a plurality of index value sequences for the plurality of sub-periods. Then, any two index values located at the same position in any two adjacent index value sequences arranged in time sequence are aimed at. And determining the difference degree between any two index values. And finally, under the condition that the difference degree is smaller than a second preset difference degree, eliminating the index values at the same position in the index value sequences to obtain a plurality of modified index value sequences.

For example, as shown in fig. 5, for any time segment 510 including the first to third sub-time segments 511 to 513, the index value sequence for each of the first to third sub-time segments 511 to 513 may be determined first, resulting in a first index value sequence 521 for the first sub-time segment 511, a second index value sequence 522 for the second sub-time segment 512 and a third index value sequence 523 for the third sub-time segment 513. If the first sub-period 511 is [8:00, 9:00 ] of the last Monday of the week, the second sub-period 512 is [8:00, 9:00 ] of the last Monday of the week, and the third sub-period 513 is [8:00, 9:00 ] of the last Monday of the week. If the plurality of times includes 8 o 'clock and 10 o' clock, the embodiment may take a first index value corresponding to 8 o 'clock and 10 o' clock from the first index value sequence 521, a second index value corresponding to 8 o 'clock and 10 o' clock from the second index value sequence 521, and a third index value corresponding to 8 o 'clock and 10 o' clock from the second index value sequence 521. Subsequently, a difference between the first index value and the second index value is calculated to obtain a first difference 531, and a difference between the second index value and the third index value is calculated to obtain a second difference 532. Finally, the first difference 531 and the second difference 532 are respectively compared with a second preset threshold, and if any difference between the first difference 531 and the second difference 532 is smaller than the second preset threshold, a first index value, a second index value and a third index value are respectively removed from the first index value sequence 521-the third index value sequence 523. And obtaining the modified first index value sequence to the third index value sequence. Accordingly, the index value sequence for any period 510 includes the first to third index value sequences after the change.

Illustratively, the difference between the two index values may be represented by a standard deviation, a variance, and the like, and the second preset threshold may be set according to an actual requirement, for example. The setting of the second preset threshold is similar to the first preset threshold described above, and is not described herein again.

FIG. 6 is a schematic diagram illustrating the determination of an alarm threshold according to another embodiment of the present application.

According to the embodiment of the application, when the alarm threshold value of each index is determined, for example, a plurality of quantile values of the index value can be determined according to the distribution information of the index values which are arranged in the size sequence. And then determining two adjacent quantile values of which the corresponding index value absolute difference is greater than a preset value in the multiple quantile values. And finally, determining the alarm threshold value of each index according to the place value with the smaller value in the two adjacent place values. According to the embodiment, the set alarm threshold value can meet the requirement of data stability by determining the place of the place, and unstable data can be higher than the alarm threshold value, so that the accuracy of the determined alarm threshold value can be improved.

For example, as shown in fig. 6, a plurality of index values for each index may be counted to obtain a distribution graph 600 of the plurality of index values. In the distribution diagram 600, the x-axis represents the index value and the y-axis represents the number of index values. This embodiment may arrange a plurality of index values along the x-axis according to the order of magnitude. From the profile 600, a plurality of quantiles of index values are calculated. In calculating the place-of-place value, the area enclosed by the distribution curve 610 shown in fig. 6 and the X axis may be calculated using the number corresponding to each index value as a weight, and then the area may be divided into n equal divisions. When calculating the area of the enclosure, the value can be taken as x₁The number of index values of (1) is used as a weight for calculating the area enclosed by the curve segment 611 and the x axis in the distribution curve 610, and the value is taken as x₂The number of index values of (a) is used as a weight for calculating an area enclosed by the curve segment 612 and the x-axis in the distribution curve 610. By analogy, the area enclosed by the distribution curve 610 and the x-axis can be calculated. The value of n may be, for example, 10, 5, 2, or the like. Each fractional value corresponding to an index valueAnd (4) taking values. Accordingly, the difference value of two index values corresponding to every two adjacent quantile values in the n quantile values can be calculated and obtained. For example, if the value of the index value corresponding to the (n-1) quantile value is 621, and if the value of the index value corresponding to the n quantile value is 622, and the absolute value of the difference between the 621 and 622 is greater than the preset value, it may be determined that the value of the index value corresponding to the (n-1) quantile value is the alarm threshold value of each index.

It is to be understood that the type of profile 600 is merely exemplary to facilitate understanding of the present application and is not intended to be limiting. In another embodiment, a histogram may be used to represent the distribution of multiple index values, and a method similar to that described above may be used to determine multiple sub-locations. The value of the preset value can be set according to actual requirements.

In an embodiment, statistics may be performed on a plurality of metric values. For example, if 90% of the index values are smaller than the first value, 91% of the index values are smaller than the second value, and the difference between the first value and the second value is greater than the preset value, the alarm threshold value is determined to be the first value.

It is understood that, in the foregoing embodiment of dividing a plurality of time instants into a plurality of time periods, the alarm threshold value for each time period may be determined by performing similar statistics as shown in fig. 6 on a plurality of index values in the index value sequence for each time period. After dividing a plurality of time points into a plurality of time periods and then dividing each time period into a plurality of sub-time periods, the alarm threshold value for each sub-time period may be determined by performing similar statistics as shown in fig. 6 on a plurality of index values in the index value sequence for each sub-time period.

According to the embodiment of the application, after the fractional value with the smaller value in the two adjacent fractional values is obtained by using the method described in fig. 6, for example, a preset correction coefficient may be used to adjust the index value corresponding to the fractional value with the smaller value, so that the adjusted index value is used as the alarm threshold. The correction coefficient may be an empirical value, or may be determined according to a historical alarm threshold value of each index, for example. The value of the correction coefficient is not limited in the present application. When the index value corresponding to the fractional value with the smaller value is adjusted by using the preset correction coefficient, the preset correction coefficient may be used as a weight to calculate a product between the index values corresponding to the fractional values with the smaller value, and the obtained product is used as the adjusted index value. By setting the preset correction coefficient, historical experience can be considered to a certain extent when the alarm threshold is determined, so that the accuracy of the determined alarm threshold is further improved.

According to the embodiment of the application, after the monitoring index and the alarm threshold value for the monitoring index are obtained through the foregoing embodiment, if there is no monitoring history for the target data, the obtained monitoring index and the alarm threshold value for the monitoring index may be used as a monitoring policy to monitor the target data.

According to the embodiment of the application, under the condition that the monitoring history aiming at the target data exists, the obtained monitoring index can be compared with the monitoring index in the monitoring history, and under the condition that the obtained monitoring index is inconsistent with the preset monitoring index in the monitoring history, first prompt information is output to prompt service personnel to change the preset monitoring index.

According to the embodiment of the application, under the condition that the obtained monitoring index is consistent with the monitoring index in the monitoring history, the determined alarm threshold value of the monitoring index can be compared with the preset alarm threshold value of the monitoring index in the monitoring history. And under the condition that the obtained alarm threshold value of the monitoring index is inconsistent with the preset alarm threshold value, outputting second prompt information to prompt service personnel to change the preset alarm threshold value of the monitoring index.

According to the embodiment of the application, the output first prompt message and/or the output second prompt message can be sent to personal terminal equipment of a service staff, or can be output through terminal equipment which generates data. Therefore, after the service personnel check the prompt information, whether the obtained monitoring index and/or the alarm threshold value of the obtained monitoring index are reasonable can be determined according to the actual situation. And if the preset monitoring index is reasonable, adjusting the preset monitoring index and/or the preset alarm threshold.

By the embodiment, business personnel can timely sense the change of data generated by the terminal equipment, so that a closed-loop continuous optimization alarm mechanism is formed, and the accuracy and timeliness of data monitoring are ensured.

According to the embodiment of the application, in the case that the target data is a plurality of data, in order to facilitate distinguishing different target data, the embodiment may also construct a graph for each target data in advance, and store the constructed graph to a predetermined storage space. In this way, when monitoring the target data, the graph corresponding to the target data can be directly obtained from the predetermined storage space, and the distribution curve of the target data and the index value distribution curve of the monitoring index of the target data can be embodied through the graph.

Based on the above-described method for monitoring data, the present application also provides a device for monitoring data, which will be described in detail below with reference to fig. 7.

Fig. 7 is a block diagram of an apparatus for monitoring data according to an embodiment of the present application.

As shown in fig. 7, the apparatus 700 for monitoring data of this embodiment may include an index value acquisition module 710, a threshold determination module 730, a saliency determination module 750, and a monitoring index determination module 770.

The index value obtaining module 710 is configured to obtain index values of a plurality of preset indexes of the target data at a plurality of times, and obtain a plurality of index values of the plurality of preset indexes. In an embodiment, the index value obtaining module 710 may be configured to perform the operation S210 described above, for example, and is not described herein again.

The threshold determining module 730 is configured to determine, for each of a plurality of preset indexes, an alarm threshold of each index according to distribution information of a plurality of index values of each index. In an embodiment, the threshold determining module 730 may be configured to perform the operation S230 described above, for example, and is not described herein again.

The significance determination module 750 is configured to determine a significance of each index with respect to time according to a plurality of index values of each index. In an embodiment, the saliency determination module 750 may be configured to perform the operation S250 described above, for example, and is not described herein again.

The monitoring index determining module 770 is configured to determine a monitoring index of the plurality of preset indexes according to the significance, so as to monitor the target data according to the monitoring index and an alarm threshold of the monitoring index. In an embodiment, the monitoring index determining module 770 may be configured to perform the operation S270 described above, for example, and will not be described herein again.

There is also provided, in accordance with an embodiment of the present application, an electronic device, a readable storage medium, and a computer program product.

Fig. 8 shows a schematic block diagram of an electronic device 800 that may be used to implement the method of monitoring data of an embodiment of the present disclosure. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the disclosure described and/or claimed herein.

As shown in fig. 8, the apparatus 800 includes a computing unit 801 that can perform various appropriate actions and processes according to a computer program stored in a Read Only Memory (ROM)802 or a computer program loaded from a storage unit 808 into a Random Access Memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The calculation unit 801, the ROM 802, and the RAM 803 are connected to each other by a bus 804. An input/output (I/O) interface 805 is also connected to bus 804.

A number of components in the device 800 are connected to the I/O interface 805, including: an input unit 806, such as a keyboard, a mouse, or the like; an output unit 807 such as various types of displays, speakers, and the like; a storage unit 808, such as a magnetic disk, optical disk, or the like; and a communication unit 809 such as a network card, modem, wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information/data with other devices via a computer network such as the internet and/or various telecommunication networks.

Computing unit 801 may be a variety of general and/or special purpose processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various dedicated Artificial Intelligence (AI) computing chips, various computing units running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, and the like. The computing unit 801 performs the various methods and processes described above, such as a method of monitoring data. For example, in some embodiments, the method of monitoring data may be implemented as a computer software program tangibly embodied in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program can be loaded and/or installed onto device 800 via ROM 802 and/or communications unit 809. When loaded into RAM 803 and executed by the computing unit 801, a computer program may perform one or more steps of the method of monitoring data described above. Alternatively, in other embodiments, the computing unit 801 may be configured to perform the method of monitoring data in any other suitable manner (e.g., by means of firmware).

Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuitry, Field Programmable Gate Arrays (FPGAs), Application Specific Integrated Circuits (ASICs), Application Specific Standard Products (ASSPs), system on a chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be special or general purpose, receiving data and instructions from, and transmitting data and instructions to, a storage system, at least one input device, and at least one output device.

Program code for implementing the methods of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the program codes, when executed by the processor or controller, cause the functions/operations specified in the flowchart and/or block diagram to be performed. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which a user can provide input to the computer. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic, speech, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a back-end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), Wide Area Networks (WANs), and the Internet.

The computer system may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.

It should be understood that various forms of the flows shown above may be used, with steps reordered, added, or deleted. For example, the steps described in the present disclosure may be executed in parallel or sequentially or in different orders, and are not limited herein as long as the desired results of the technical solutions disclosed in the present disclosure can be achieved.

The above detailed description should not be construed as limiting the scope of the disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may be made in accordance with design requirements and other factors. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present disclosure should be included in the scope of protection of the present disclosure.

Claims

1. A method of monitoring data, comprising:

acquiring index values of a plurality of preset indexes aiming at target data at a plurality of moments respectively to obtain a plurality of index values of the preset indexes respectively;

for each index in the preset indexes, determining an alarm threshold value of each index according to distribution information of a plurality of index values of each index;

determining the significance of each index changing along with time according to a plurality of index values of each index; and

and determining a monitoring index in the preset indexes according to the significance, so as to monitor the target data according to the monitoring index and an alarm threshold value of the monitoring index.

2. The method of claim 1, wherein determining the alarm threshold for each metric comprises:

dividing the plurality of time instants into a plurality of time periods;

for each of the plurality of periods:

determining an index value sequence of each index for each time interval according to the index value of each index at each time in each time interval; and

and determining an alarm threshold value of each index aiming at each time interval according to the distribution information of the index values in the index value sequence.

3. The method of claim 2, wherein,

determining the sequence of indicator values for the each indicator for the each period comprises:

dividing each time interval into a plurality of sub-time intervals according to a preset rule;

for each sub-period in the plurality of sub-periods, determining an index value sequence for each sub-period according to the index value of each index at each moment in each sub-period;

determining the alarm threshold for the each metric for the each time period comprises: for each sub-period in the plurality of sub-periods, determining an alarm threshold value of each index for each sub-period according to the index value sequence of each index for each sub-period.

4. The method of claim 3, wherein said dividing said each time interval into a plurality of sub-time intervals according to a preset rule comprises:

dividing each time interval into a plurality of sub-time intervals according to the difference degree between the index values of two adjacent moments of each index in each time interval, so as to divide two moments corresponding to two index values with the difference degree larger than a first preset threshold value into different sub-time intervals.

5. The method of claim 3, wherein determining the sequence of indicator values for each of the sub-periods comprises:

rejecting abnormal index values in the index values of each index at each moment in each sub-period to obtain residual index values; and

and determining the sequence of the residual index values as the index value sequence for each sub-period.

6. The method of claim 2, wherein each of said periods comprises a plurality of subintervals at a same time interval in a plurality of time periods; determining the sequence of indicator values for the each indicator for the each period comprises:

for each sub-period in the plurality of sub-periods, determining an index value sequence for each sub-period according to the index value of each index at each moment in each sub-period to obtain a plurality of index value sequences for the plurality of sub-periods;

for any two index values located at the same position in any two adjacent index value sequences arranged in time order:

determining the difference degree between any two index values; and

and under the condition that the difference degree between any two index values is greater than a second preset threshold value, eliminating the index values positioned at the same position in the index value sequences to obtain a plurality of modified index value sequences.

7. The method of any of claims 1-6, wherein determining the alarm threshold for each metric comprises:

determining a plurality of place values of the index values according to the distribution information of the plurality of index values in the size sequence arrangement;

determining two adjacent quantile values of which the corresponding index value absolute difference values are larger than a preset value in the multiple quantile values; and

and determining the alarm threshold value of each index according to the place value with the smaller value in the two adjacent place values.

8. The method of claim 7, wherein the determining the alarm threshold value of each index according to the place value with the smaller value of the two place values comprises:

and determining the product of the index value corresponding to the place value with the smaller value in the two place values and a preset correction coefficient to be used as the alarm threshold value of each index.

9. The method of claim 1, further comprising at least one of:

outputting first prompt information to prompt to change the preset monitoring index under the condition that the monitoring index is inconsistent with the preset monitoring index;

and outputting second prompt information under the condition that the alarm threshold of the monitoring index is inconsistent with the preset alarm threshold of the monitoring index so as to prompt the change of the preset alarm threshold of the monitoring index.

10. The method of claim 1, wherein obtaining index values for a plurality of preset indices for target data at a plurality of time instances each comprises:

acquiring numerical values of the target data at the plurality of moments; and

and determining index values of the preset indexes of the target data at the multiple moments according to the numerical values of the target data at the multiple moments.

11. An apparatus for monitoring data, comprising:

the index value acquisition module is used for acquiring the index values of a plurality of preset indexes aiming at the target data at a plurality of moments respectively to obtain a plurality of index values of the preset indexes respectively;

the threshold value determining module is used for determining an alarm threshold value of each index according to distribution information of a plurality of index values of each index aiming at each index in the plurality of preset indexes;

the significance determination module is used for determining the significance of each index changing along with time according to the plurality of index values of each index; and

and the monitoring index determining module is used for determining a monitoring index in the preset indexes according to the significance so as to monitor the target data according to the monitoring index and an alarm threshold value of the monitoring index.

12. An electronic device, comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-10.

13. A non-transitory computer readable storage medium having stored thereon computer instructions for causing the computer to perform the method of any of claims 1-10.

14. A computer program product comprising a computer program which, when executed by a processor, implements a method according to any one of claims 1 to 10.